parse-container.c 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright 2018-2019 NXP
  4. */
  5. #include <common.h>
  6. #include <errno.h>
  7. #include <log.h>
  8. #include <spl.h>
  9. #include <asm/arch/image.h>
  10. #include <asm/arch/sci/sci.h>
  11. #define SEC_SECURE_RAM_BASE 0x31800000UL
  12. #define SEC_SECURE_RAM_END_BASE (SEC_SECURE_RAM_BASE + 0xFFFFUL)
  13. #define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE 0x60000000UL
  14. #define SECO_PT 2U
  15. #ifdef CONFIG_AHAB_BOOT
  16. static int authenticate_image(struct boot_img_t *img, int image_index)
  17. {
  18. sc_faddr_t start, end;
  19. sc_rm_mr_t mr;
  20. int err;
  21. int ret = 0;
  22. debug("img %d, dst 0x%x, src 0x%x, size 0x%x\n",
  23. image_index, (uint32_t)img->dst, img->offset, img->size);
  24. /* Find the memreg and set permission for seco pt */
  25. err = sc_rm_find_memreg(-1, &mr,
  26. img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
  27. ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1);
  28. if (err) {
  29. printf("can't find memreg for image %d load address 0x%x, error %d\n",
  30. image_index, img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1), err);
  31. return -ENOMEM;
  32. }
  33. err = sc_rm_get_memreg_info(-1, mr, &start, &end);
  34. if (!err)
  35. debug("memreg %u 0x%x -- 0x%x\n", mr, start, end);
  36. err = sc_rm_set_memreg_permissions(-1, mr,
  37. SECO_PT, SC_RM_PERM_FULL);
  38. if (err) {
  39. printf("set permission failed for img %d, error %d\n",
  40. image_index, err);
  41. return -EPERM;
  42. }
  43. err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
  44. 1 << image_index);
  45. if (err) {
  46. printf("authenticate img %d failed, return %d\n",
  47. image_index, err);
  48. ret = -EIO;
  49. }
  50. err = sc_rm_set_memreg_permissions(-1, mr,
  51. SECO_PT, SC_RM_PERM_NONE);
  52. if (err) {
  53. printf("remove permission failed for img %d, error %d\n",
  54. image_index, err);
  55. ret = -EPERM;
  56. }
  57. return ret;
  58. }
  59. #endif
  60. static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image,
  61. struct spl_load_info *info,
  62. struct container_hdr *container,
  63. int image_index,
  64. u32 container_sector)
  65. {
  66. struct boot_img_t *images;
  67. ulong sector;
  68. u32 sectors;
  69. if (image_index > container->num_images) {
  70. debug("Invalid image number\n");
  71. return NULL;
  72. }
  73. images = (struct boot_img_t *)((u8 *)container +
  74. sizeof(struct container_hdr));
  75. if (images[image_index].offset % info->bl_len) {
  76. printf("%s: image%d offset not aligned to %u\n",
  77. __func__, image_index, info->bl_len);
  78. return NULL;
  79. }
  80. sectors = roundup(images[image_index].size, info->bl_len) /
  81. info->bl_len;
  82. sector = images[image_index].offset / info->bl_len +
  83. container_sector;
  84. debug("%s: container: %p sector: %lu sectors: %u\n", __func__,
  85. container, sector, sectors);
  86. if (info->read(info, sector, sectors,
  87. (void *)images[image_index].entry) != sectors) {
  88. printf("%s wrong\n", __func__);
  89. return NULL;
  90. }
  91. #ifdef CONFIG_AHAB_BOOT
  92. if (authenticate_image(&images[image_index], image_index)) {
  93. printf("Failed to authenticate image %d\n", image_index);
  94. return NULL;
  95. }
  96. #endif
  97. return &images[image_index];
  98. }
  99. static int read_auth_container(struct spl_image_info *spl_image,
  100. struct spl_load_info *info, ulong sector)
  101. {
  102. struct container_hdr *container = NULL;
  103. u16 length;
  104. u32 sectors;
  105. int i, size, ret = 0;
  106. size = roundup(CONTAINER_HDR_ALIGNMENT, info->bl_len);
  107. sectors = size / info->bl_len;
  108. /*
  109. * It will not override the ATF code, so safe to use it here,
  110. * no need malloc
  111. */
  112. container = (struct container_hdr *)spl_get_load_buffer(-size, size);
  113. debug("%s: container: %p sector: %lu sectors: %u\n", __func__,
  114. container, sector, sectors);
  115. if (info->read(info, sector, sectors, container) != sectors)
  116. return -EIO;
  117. if (container->tag != 0x87 && container->version != 0x0) {
  118. printf("Wrong container header");
  119. return -ENOENT;
  120. }
  121. if (!container->num_images) {
  122. printf("Wrong container, no image found");
  123. return -ENOENT;
  124. }
  125. length = container->length_lsb + (container->length_msb << 8);
  126. debug("Container length %u\n", length);
  127. if (length > CONTAINER_HDR_ALIGNMENT) {
  128. size = roundup(length, info->bl_len);
  129. sectors = size / info->bl_len;
  130. container = (struct container_hdr *)spl_get_load_buffer(-size, size);
  131. debug("%s: container: %p sector: %lu sectors: %u\n",
  132. __func__, container, sector, sectors);
  133. if (info->read(info, sector, sectors, container) !=
  134. sectors)
  135. return -EIO;
  136. }
  137. #ifdef CONFIG_AHAB_BOOT
  138. memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container,
  139. ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
  140. ret = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
  141. SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
  142. if (ret) {
  143. printf("authenticate container hdr failed, return %d\n", ret);
  144. return ret;
  145. }
  146. #endif
  147. for (i = 0; i < container->num_images; i++) {
  148. struct boot_img_t *image = read_auth_image(spl_image, info,
  149. container, i,
  150. sector);
  151. if (!image) {
  152. ret = -EINVAL;
  153. goto end_auth;
  154. }
  155. if (i == 0) {
  156. spl_image->load_addr = image->dst;
  157. spl_image->entry_point = image->entry;
  158. }
  159. }
  160. end_auth:
  161. #ifdef CONFIG_AHAB_BOOT
  162. if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0))
  163. printf("Error: release container failed!\n");
  164. #endif
  165. return ret;
  166. }
  167. int spl_load_imx_container(struct spl_image_info *spl_image,
  168. struct spl_load_info *info, ulong sector)
  169. {
  170. return read_auth_container(spl_image, info, sector);
  171. }